🔍 Read the full analysis: France Alleges Iran’s Guards Hacked Fridges At Its Supermarkets on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
France said on November 9 that an IRGC cyber unit called Shahid Kaveh was responsible for an October attack that disrupted supermarket refrigeration systems at about 700 sites. The government cited technical indicators and announced diplomatic and legal steps, but the attribution is France’s assessment, not a court finding; Iran had not publicly responded by Monday evening, according to The Record.
France on November 9 attributed an overnight cyberattack on refrigeration systems at about 700 supermarket sites to Shahid Kaveh, a cyber unit the government says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). French officials said the attack caused major food losses and at least 15 fires; the government plans to propose new EU sanctions, while prosecutors have opened an investigation and are seeking international arrest warrants.
The attack took place during the night of October 11–12, when refrigeration controllers at French retail sites were accessed and their defrost settings changed. A report published by France’s Cyber Crisis Coordination Centre, or C4, says the equipment was set to defrost at high temperatures. It records significant losses of goods and fires in at least 15 cases. France’s foreign ministry put the number of affected sites at more than 700; the technical report describes about 700.
The French foreign ministry issued a formal declaration attributing the operation to Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. Foreign Minister Jean-Noël Barrot also said the IRGC carried out the attack, according to AFP. The C4 report presents several indicators supporting France’s assessment: shared infrastructure used to scan industrial equipment, use of the FOFA internet-scanning tool, a propaganda channel’s relay of the attack, and traces of Farsi in the infrastructure. The Paris prosecutor’s office also cited IP addresses linked to devices located in Iran, according to the Associated Press.
France has taken diplomatic and judicial steps alongside the attribution. The Iranian ambassador was summoned, and Paris says it will propose additional European Union sanctions. Prosecutor Laure Beccuau opened an investigation targeting the alleged unit head, two deputies and any other people identified during the inquiry. The prosecutor is seeking international arrest warrants, the AP reported. These are investigative measures and accusations; they do not amount to convictions.
France blames Iran-linked unit for supermarket fridge hack
France says an October cyberattack disrupted refrigeration at about 700 supermarket sites. The attribution is the government’s assessment, not a court finding.
How the attack disrupted stores
Refrigeration controllers were accessed and their defrost settings changed.
Management interfaces for refrigeration equipment were exposed to the internet, France’s emergency team warned.
The equipment was set to defrost at high temperatures.
France reported major food losses and fires in at least 15 cases.
Why France points to Shahid Kaveh
France’s technical report describes several indicators supporting its attribution, rather than one publicly presented proof.
Shared scanning systems
The report says infrastructure also scanned industrial equipment.
FOFA activity
France cited use of the internet-scanning tool and industrial protocol activity.
Farsi traces
The report identified traces of Farsi in the infrastructure.
Claim relayed online
A propaganda channel reportedly relayed the attack claim.
What happens next
France has announced diplomatic and judicial steps; their outcomes remain uncertain.
- Iran’s ambassador was summoned.
- France says it will propose additional EU sanctions.
- Prosecutors opened an investigation into the alleged unit leadership and others.
- International arrest warrants are being sought; no convictions are established.
Costs for Retailers and Governments
The incident shows how an attack on building and refrigeration equipment can disrupt an everyday service without targeting a supermarket’s payment systems or customer data. Changing controller settings can put food supplies and equipment at risk, creating direct costs for retailers and potential safety hazards. France’s report documents major product losses and fires, although a complete accounting of the financial damage has not been published in the material available here.
The government’s response also raises the stakes beyond the affected stores. France is publicly assigning responsibility to a foreign state-linked unit and seeking EU-level sanctions, while its prosecutors pursue legal action across borders. The attribution could shape diplomatic relations and other governments’ assessments of cyber threats. The evidence remains France’s case: it has not been tested in court, and Iran’s public response was not reported by Monday evening.
Products Worth Considering
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
France’s cyber crisis centre published a five-page technical report through CERT-FR on November 9. The report’s conclusions draw on a bundle of indicators, rather than one definitive piece of publicly described evidence. It says the same infrastructure was used around the time of the attack to scan Schneider Electric equipment used in smaller energy and water production facilities. The report connects the use of the Modbus industrial protocol on port 502 to techniques it says Shahid Kaveh had used since at least April 2026.
The report also identifies FOFA scanning activity, a claim of responsibility relayed by the outlet CyberbanNews from October 13, and traces of Farsi. The Paris prosecutor added the reported links to IP addresses associated with devices in Iran. Cyber attribution can be difficult because attackers may route traffic through third-party systems or leave misleading clues. France says the indicators together support its conclusion; the published material does not itself constitute a judicial finding.
France’s report also attributes earlier operations against French targets since 2020 to a separate IRGC unit, Shahid Shoostari, including an attack on the Charlie Hebdo website in 2023 and an attempted hijacking of video display screens during the Paris 2024 Olympics. Those allegations are separate from the supermarket incident. In October, France’s computer emergency response team warned that the affected refrigeration controllers had management interfaces exposed to the internet, contrary to good practice.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, as quoted by AFP
Evidence and Response Still Pending
The attribution is an official French conclusion, but the published indicators have not been tested in court. The source material does not provide a full forensic record or independent confirmation of the government’s account. Iran had not publicly responded by Monday evening, according to The Record. It is also unclear whether Tehran will contest the attribution or whether other governments will publicly endorse it.
The full scale of the damage remains uncertain. France’s foreign ministry described food losses as several tens of millions of euros, while the AP reported that Intermarché alone cited losses of tens of millions of euros in a single day. The source material gives no consolidated audited total or complete count of affected retailers. It also does not establish whether the exposed internet-facing interfaces were the attackers’ only route into the systems.
France’s request for international arrest warrants is not the same as arrests or a court judgment. The available information does not say whether warrants have been issued, which jurisdictions might act on them, or what evidence could be made public during the investigation. Responsibility remains an allegation until established through legal proceedings.
Sanctions and Investigation Ahead
France says it will propose new EU sanctions, but the material does not give a timetable or identify the proposed measures. EU action would require further discussion among member states. France has summoned Iran’s ambassador, and the diplomatic response may develop depending on Iran’s position and any reaction from other governments.
In Paris, the judicial investigation will examine the alleged role of Shahid Kaveh’s leadership and other potential participants. Prosecutors are seeking international arrest warrants, though their status and prospects are not yet clear. Meanwhile, retailers and operators of connected building equipment may face pressure to review internet exposure and access controls on refrigeration systems, following the French emergency team’s earlier warning about exposed management interfaces.
Further reporting may clarify the affected sites, the verified financial losses, the investigation’s evidence and whether the proposed sanctions advance. For now, the confirmed development is France’s formal attribution and the steps it says it will take; the underlying responsibility has not been adjudicated.
Key Questions
What happened to the French supermarkets?
During the night of October 11–12, 2026, attackers changed defrost settings on refrigeration controllers at about 700 retail sites, according to France’s cyber crisis centre. The report says the incident caused significant goods losses and at least 15 fires.
Who does France say was responsible?
France attributes the attack to Shahid Kaveh, a cyber unit the government says is affiliated with Iran’s Islamic Revolutionary Guard Corps. This is France’s official assessment, not a court ruling.
What evidence did France cite?
The French report points to shared attack infrastructure, use of the FOFA scanning tool, a propaganda outlet’s relay of the attack and traces of Farsi. The Paris prosecutor also cited IP addresses linked to devices in Iran, according to the AP.
How much damage did the attack cause?
France’s foreign ministry described food losses as several tens of millions of euros. The available source material does not give a consolidated, independently audited total for all affected retailers.
What happens next?
France says it will propose new EU sanctions. Paris prosecutors are investigating and seeking international arrest warrants; it is not yet clear whether warrants have been issued or whether other countries will act on them.
Source: ThorstenMeyerAI.com
